A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the oddjob-0.34.7-6.el9 build changelog.

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5169-1 advisory.

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has oddjob packages installed that are affected by a vulnerability:

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the oddjob packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A race condition was found in the mkhomedir tool     shipped with the oddjob package in versions before     0.34.5 and 0.34.6 wherein, during the home creation,     mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's     user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by     creating a symlink point to a target folder, which then     has its ownership transferred to the new home     directory's unprivileged user.(CVE-2020-10737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4687 advisory.

  - oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack     (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4687 advisory.

  - A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5     and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly     created home and changes its ownership to the home's user without properly checking the homedir path. This     flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then     has its ownership transferred to the new home directory's unprivileged user. (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4687 advisory.

  - oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack     (CVE-2020-10737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update includes a security fix for CVE-2020-10737. Additionally,

From 0.34.6 :

  - update license on src/buffer.h

  - changes '/var/run' to '/run' in systemd service file     (Orion Poplawski, #1834511)

From 0.34.5 :

  - apply patch from Matthias Gerstner of the SUSE security     team to fix a possible race condition in the mkhomedir     helper (noted above, this fixes CVE-2020-10737)

  - only process SELinux contexts if SELinux is not disabled     (Alexander Bokovoy, #1828855)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
191180	CentOS 9 : oddjob-0.34.7-6.el9	Nessus	CentOS Local Security Checks	medium
183152	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : oddjob vulnerability (USN-5169-1)	Nessus	Ubuntu Local Security Checks	medium
147336	NewStart CGSL MAIN 6.02 : oddjob Vulnerability (NS-SA-2021-0063)	Nessus	NewStart CGSL Local Security Checks	medium
146690	EulerOS 2.0 SP2 : oddjob (EulerOS-SA-2021-1334)	Nessus	Huawei Local Security Checks	medium
145910	CentOS 8 : oddjob (CESA-2020:4687)	Nessus	CentOS Local Security Checks	medium
144180	EulerOS 2.0 SP8 : oddjob (EulerOS-SA-2020-2524)	Nessus	Huawei Local Security Checks	medium
142771	Oracle Linux 8 : oddjob (ELSA-2020-4687)	Nessus	Oracle Linux Local Security Checks	medium
142405	RHEL 8 : oddjob (RHSA-2020:4687)	Nessus	Red Hat Local Security Checks	medium
142132	EulerOS 2.0 SP5 : oddjob (EulerOS-SA-2020-2260)	Nessus	Huawei Local Security Checks	medium
140853	EulerOS 2.0 SP3 : oddjob (EulerOS-SA-2020-2086)	Nessus	Huawei Local Security Checks	medium
136756	Fedora 31 : oddjob (2020-b1fa09aa64)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-10737

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium